In light of the NSA, how to think about encryption

Encryption is an arms race. It is, perhaps, one of the true fundamental arms races in the history of warfare. In World War II, for example, the Allies' ability to decrypt the Axis communications (without their knowing about it) was a factor leading to ultimate victory.

Encryption has always been the purview of the nation state and those, by virtue of concentration of economic and other resources, who essentially function as nation states (extremely wealthy individuals and large corporations).

The key to this arms race is a simple fact: some people don't want other people to read their stuff. At the very same time, some people want to read stuff others don't want them to read.

The most basic point you need to know when considering encryption is that those who encrypt do so to keep things private from those who would otherwise want to read those same private things.

In other words, encryption is a battle of wills. On one side are the encryption users, using ever more complex encryption to keep their adversaries out of their communication. On the other side are the entities who want to read those very same communications. They will use whatever means available to decrypt those communications.

This is as it has always been. This is as it shall always be.

So what does that mean in light of the latest round of NSA revelations and what does it mean for you?

Let's start with the NSA

At it's most mission-centered level, the NSA's role is signals intelligence. Key to signals intelligence is cracking encryption. The NSA lives to crack encryption. So it has been. So it shall always be. To think otherwise would be foolish.

The same is likely true for other states, especially active players like China, India, Brazil, Russia, Israel, the Koreas, the U.K., Germany, Japan, and others. How capable each of these countries are at cracking signals intelligence is a function of the quality of their scientists, their budgets, and the information shared by their allies.

But rest assured, governments crack encryption. If there happens to be some kind of encryption they can't crack, they don't just write it off. They redouble their efforts to find a way to get inside those communication streams.

It is what they do. National security (and often national sovereignty) depends on it.

Encryption in the hands of enemy actors

Now, let's talk about encryption in the hands of consumers and enterprises. But first, let's talk about encryption in the hands of enemy actors, like terrorists and criminals.

Terrorists and criminals often operate as part of organizations, with leadership and management structures, and rank and file members. Command and control communication critical to the operation of these entities, especially in cases where sleepers have been long embedded in target communities.

These enemy actors use encryption (and a wide array of other methods, often in combination with encryption) to keep their communications private. A terrorist strike, for example, often needs months of global coordination, resource management, and human operative movements to prepare -- and all of that often needs to be discussed across national boundaries.

Government agencies like the FBI and NSA and state and local law enforcement need to see into these communications to protect our citizens. This is done through technological methods (like decryption technology) and through very old-school methods, like infiltrating an undercover operative.

The bottom-line, though, is that terrible attacks and major crimes can be prevented by government and law enforcement by gaining visibility into communications the bad guys would like to keep hidden.

Encryption in the hands of consumers and enterprises

Next, let's move on to the subject of encryption in the hands of people like us and the companies we work for. What do we need encryption for? In a word: privacy.

At the enterprise level, we use encryption to make sure competitors can't see into our product plans and directions. We use encryption to make sure certain employees can be compartmentalized, so other employees don't leak information too soon. We use encryption to protect the organization from criminals and hackers who might try to steal corporate trade secrets or financial information.

Consumer-level encryption is where things start to take on shades of gray. Let's look at the easy aspects of consumer-level encryption first.

We want to be able to encrypt our financial transactions and Web shopping cart pages so hackers can't steal our credit cards. That's the simple, obvious, and necessary form of encryption. Generally we don't care if governments can access that data, because, really, how much does the NSA want to know if you bought another pair of shoes?

But then we get to encryption for personal protection. At the most prurient level, some folks out there want to be able to hide their tracks when they're doing inappropriate Web searches (let's say porn). But others want privacy when they're doing sensitive Web searches (let's say a search into AIDS symptoms or how to find a divorce lawyer).

Consumers need privacy for personal activities. Medical discussions, spousal abuse issues, family-related problems that they don't want to see shared far and wide on Facebook.

The key with this level of activity is that while privacy and encryption may be incredibly important, it's not something the NSA is going to want or need to track. Consumer level encryption that keeps out family members and predators will do fine to keep you safe.

But then we get to the whole dissident issue, where individuals and groups are coordinating activities and discussions under the thumb of oppressive regimes. For example, take the coordinated protects of the Arab Spring. The people participating in these protests (who are trying to change their nations) have need to communicate (and do so in a way their governments can't see). An intercepted communication could easily mean arrest and possibly execution.

Some here in the Western world would say that private, dissident communication is as necessary in America as it is in, say, Tunisia. State and local governments have different agendas than the federal government and have been known to persecute individuals based on their religious affiliations or their sexual orientation. Private, safe communication is essential to these individuals as well.

In most of these cases, good quality public-key encryption will keep most consumers safe from hackers, predators, and those who would discriminate. These issues are almost never a matter of national security concern -- unless, of course, these "weaknesses" are exploited by other nation states or terrorist organizations for nefarious purposes, in which case that is something we'll need to know to prevent serious repercussions.

My point here, though, is relatively simple: the NSA is probably not worried about your normal communications and the encryption you use for your daily activities is good enough.

There is one issue, though...

The back door problem

Back doors in code have existed since there were code systems in place. The idea is that it's possible to get back into a system when locked out by other means.

This may need to happen for a variety of reasons, from the prosaic (someone lost the master login password or authenticator) to the terrifying (bad guys got into a system and locked out legitimate users).

But back doors are, by their very nature, security risks. If a back door is available, then not only can legitimate network management get back into a system, anyone who knows how to get into the back door can use it as well.

This is particularly relevant to our discussion of NSA decryption activities because it is has been reported that various encryption vendors have enabled back doors for the NSA. I can see and understand the reason behind this practice, but in this area alone, I have to disagree with the NSA practice.

Enabling back doors levels the playing field among all players and diminishes the NSA's unique advantage at the same time. One of the reasons the NSA is able to maintain a level of intelligence unparalleled anywhere in the world is its extreme concentration of computing power and SIGINT resources. This is a barrier of entry that almost no other nation, and certainly no other terrorist group, organized crime organization, or even large enterprise can hope to pass through.

This barrier of entry has always meant that the NSA (and only the NSA) can get information that no other entity is capable of getting -- and that's how it should be. But if the NSA is "cheating" and doing deals that are embedding back doors in encryption technology, then those back doors are potentially available for anyone who finds them. And that defeats the NSA's most powerful advantage while putting many of us at greater risk.

In my opinion, the back door policy the NSA is reportedly encouraging may provide a short-term tactical advantage, but it may prove to cause us all problems in the long-term.

Other than that, don't sweat the NSA's decryption capabilities. If you're not an enemy actor, you're not going to be on their radar.